What is the CVSS score of CVE-2025-5599?

CVE-2025-5599 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2025-5599?

A SQL injection vulnerability in PHPGurukul Student Result Management System 1.3 allows remote attackers to compromise database integrity and access sensitive student and employee data.

Is there a public PoC exploit available for CVE-2025-5599?

Yes, a public proof-of-concept exploit is available for CVE-2025-5599. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-5599?

Within 24 hours: Isolate affected systems from production networks or disable public access to the /editmyexp.php endpoint. Within 7 days: Implement Web Application Firewall (WAF) rules to block SQL injection patterns in the emp1ctc parameter and conduct database access logs review for suspicious activity. Within 30 days: Evaluate migration to a patched version or alternative Student Result Management System, and perform full security audit of all database access and stored data.

PHP CVE-2025-5599

EUVD-2025-16901 HIGH

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-06-04 cna@vuldb.com

PHP SQLi Student Result Management System

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 17:29 euvd

EUVD-2025-16901

Analysis Generated

Mar 14, 2026 - 17:29 vuln.today

PoC Detected

Jun 09, 2025 - 15:00 vuln.today

Public exploit code

CVE Published

Jun 04, 2025 - 18:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability classified as critical was found in PHPGurukul Student Result Management System 1.3. This vulnerability affects unknown code of the file /editmyexp.php. The manipulation of the argument emp1ctc leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Critical SQL injection vulnerability in PHPGurukul Student Result Management System version 1.3, exploitable through the emp1ctc parameter in /editmyexp.php. An unauthenticated remote attacker can manipulate this parameter to inject malicious SQL commands, potentially leading to unauthorized data access, modification, or deletion. With a publicly disclosed exploit and CVSS 7.3 rating reflecting network-based remote exploitation with low attack complexity and no authentication requirements, this vulnerability poses significant risk to exposed instances.

Technical ContextAI

The vulnerability stems from improper input validation and parameterization in the /editmyexp.php file, classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The vulnerable parameter 'emp1ctc' is processed without adequate SQL query parameterization or input sanitization, allowing an attacker to break out of the intended SQL context and inject arbitrary SQL code. PHPGurukul Student Result Management System is a PHP-based web application (CPE context suggests: cpe:2.3:a:phpgurukul:student_result_management_system:1.3), likely running on Apache/Nginx with PHP and a MySQL/MariaDB backend. The root cause is the absence of prepared statements or parameterized queries, relying instead on direct string concatenation of user input into SQL statements.